daily plain-text briefing: security, markets, business, and pittsburgh
Progress Software ordered ShareFile customers to power down their servers against a credible active threat, while researchers showed a single PNG image can hijack AI coding agents and drain a repository's secrets.
Latest developments: Zimbra urged customers July 11, 2026 to patch a critical stored cross-site-scripting flaw in the Classic Web Client, still without a CVE, that lets a specially crafted email run malicious scripts and achieve arbitrary code execution inside a victim's session.
Zimbra runs email for governments and enterprises worldwide and draws frequent attacks; administrators should apply the update at once.
Sources: The Hacker News · ↑ top
Latest developments: The Australian Cyber Security Centre issued an alert July 11, 2026 warning of a global campaign exploiting vulnerable content management systems and their plugins.
The ACSC flagged mass exploitation of outdated CMS platforms and add-ons that attackers use to plant web shells; site operators should patch core software and plugins and audit for compromise.
Sources: BleepingComputer · ↑ top
Latest developments: Researchers unveiled Ghostcommit on July 11, 2026, a technique that buries a prompt injection inside a PNG image, sails past AI code reviewers CodeRabbit and Bugbot that never open image files, and tricks a coding agent into reading a repository's .env file and writing every secret into the code as a list of numbers.
The attack turns AI coding assistants into exfiltration tools; teams that let agents review or commit code should treat image files as untrusted input and cut off agent access to secrets.
Sources: BleepingComputer · ↑ top
Latest developments: Progress Software emailed ShareFile customers on July 10, 2026 to immediately power down the Windows servers running their Storage Zone Controllers over a 'credible external security threat,' and temporarily cut access to affected accounts out of an abundance of caution.
Storage Zone Controllers move files for the on-premises version of Progress's ShareFile secure file-sharing platform; administrators should shut the servers down and watch for guidance while Progress investigates.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: A 34-year-old Armenian man pleaded guilty July 10, 2026 in Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against U.S. companies, facing up to 15 years, while a Florida court handed a Blackcat/AlphV conspirator a 70-month sentence for helping extort multiple victims.
Ryuk encrypted companies and hospitals across the U.S. at its peak, and AlphV ran one of the most prolific extortion operations; the two cases mark continued law-enforcement pressure on ransomware affiliates years after the crimes.
Sources: BleepingComputer · The Record · ↑ top
Latest developments: Researchers disclosed six vulnerabilities July 10, 2026 in the widely used U-Boot bootloader that let attackers run malicious code during device boot, opening the door to stealthy firmware attacks and persistent malware.
U-Boot boots countless embedded and IoT devices; the flaws let an attacker subvert security protections before the operating system loads, so device vendors need to ship firmware fixes.
Sources: BleepingComputer · ↑ top
This Afternoon: Isolated Showers And Thunderstorms, high 83F.
Tonight: Scattered Showers And Thunderstorms then Mostly Cloudy, low 65F.
Sunday: Mostly Sunny, high 86F.
Latest developments: The city of Pittsburgh celebrated the pool's grand opening Saturday, July 11.
Pittsburgh reopened the Homewood Pool as the centerpiece of a $22.87 million transformation of Homewood Park in the city's East End.
Latest developments: Hamlin's Chasing M's Foundation is sponsoring the weekend camp and all-star game.
Buffalo Bills safety Damar Hamlin, through his Chasing M's Foundation, is running a youth football camp and all-star game for Pittsburgh-area children this weekend in his hometown region.
Latest developments: The museum announced the symposium as part of America's 250th commemoration.
The Fort Pitt Museum, at Point State Park in downtown Pittsburgh, will host a 1776 Symposium marking the nation's 250th anniversary of independence, exploring the American Revolution and the western frontier.
Latest developments: The locomotive's western Pennsylvania run Saturday, July 11, ends with a stop in Leetsdale.
Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, rolls through western Pennsylvania on Saturday, July 11, on its cross-country tour marking America's 250th birthday, capping the day with a stop in Leetsdale in Allegheny County.
Latest developments: The Post-Gazette published a Q&A with Elfman ahead of his appearance.
Film composer Danny Elfman, known for his scores for Tim Burton's movies and the theme to 'The Simpsons,' will appear in Pittsburgh, and in a Post-Gazette interview he discussed the shrinking audience for classical music.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (47-47)
Fri Jul 10 · Brewers @ Pirates · Postponed
Up Next · Brewers @ Pirates · Sat Jul 11, 12:05 PM
Latest developments: The Pirates closed the trade Friday night, July 10.
The Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox, sending pitcher Jaden Woods and the No. 34 overall pick in the 2026 draft to Chicago; general manager Ben Cherington said the club weighed multiple ways to use the compensation pick to strengthen a roster battered by pitching injuries.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette reported July 10 on his extension leverage.
Steelers cornerback Joey Porter Jr. is angling for a contract extension as the cornerback market booms behind deals for Devon Witherspoon and Sauce Gardner, and the Post-Gazette weighed how much Pittsburgh will pay to keep him.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette's July 11 Off The Bat charted the power surge.
The Pirates have already topped last season's full-year home run total, and the Post-Gazette traced the jump to bats including Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN examined whether Pulisic deserves blame for the exit.
Christian Pulisic, the U.S. men's national team's biggest star, underwhelmed at the home World Cup, and ESPN weighed how much blame he deserves for the round-of-16 loss to Belgium.
Sources: ESPN Soccer · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1%